Researchers: nearly two years after US banned the use of Kaspersky by the government, its software can still be found on military and other federal networks
Thomas Brewster / Forbes : Tweets: @expanseinc Tweets: Expanse / @expanseinc : Expanse discovered that at least two US military networks, eight non-military government networks, and 14 defense contractors are still using Kaspersky - a Russian security software that the US banned across all government departments in 2017. Read more: https://www.forbes.com/...
Context & Ripple Effects
The ban this article audits began with procurement, not detection: in July 2017 the GSA removed Kaspersky Lab from its approved-vendor lists, and months later reporting tied the software to the loss of NSA cyber tools from a contractor's laptop. What Expanse adds is the missing measurement layer — a scan showing the ban never actually reached the machines.
The finding lands awkwardly against the policy debate around it: officials had already flagged that enforcement was hard because of Kaspersky's large installed base, a concern visible in the White House's internal split over sanctions. The gap Expanse documents is between what agencies were told to buy and what was actually running.
First-order effects
- At least two military networks, eight other government networks, and 14 defense contractors identified by Expanse face immediate remediation pressure — uninstalling software their own procurement rules should have excluded years earlier.
- The ban's enforcement mechanism is exposed as passive: removing Kaspersky from purchasing lists stopped new buys but did nothing about licenses and installs already in place.
Second-order effects
- Defense contractors now inherit a compliance liability they cannot outsource to vendors — a banned Russian product on their networks is an audit finding regardless of how it got there.
- The enforcement-difficulty argument used inside the White House's sanctions debate gets harder evidence behind it: if a full government ban left dozens of networks unscanned, financial sanctions would face the same discovery problem.
Third-order effects
- The episode points toward bans being paired with continuous network-scanning mandates rather than one-time procurement exclusions — the difference between prohibiting a purchase and verifying an absence.
- The endgame the corpus shows is market exit rather than compliance: Kaspersky ultimately winds down its US business ahead of a sales ban, with customer software replaced by an American-owned product — meaning the residual-install problem eventually resolves by attrition, not by agency action.
The trend: Government technology bans are shifting from procurement blacklists toward verified enforcement, as the Kaspersky case shows exclusion lists alone leave banned software running on sensitive networks for years.